Hacker News new | ask | show | jobs
by paularmstrong 173 days ago
The code is literally right there for you. It doesn't matter what ecosystem or package manager. Someone could distribute the same thing anywhere — it's up to those pulling it in to actually start auditing what they're accepting.